Does the plugin allow to restrict downloads from a fixed IP address only?

This is not regulated by the plugin but rather in your S3 account. You can set a bucket policy for this purpose using CloudBerry Explorer or any other AWs client application or write your own, like this:

    "Version": "2008-10-17",
    "Id": "S3PolicyId1",
    "Statement": [
            "Sid": "IPAllow",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*" 
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::mybucket/*",
            "Condition" : {
                "IpAddress" : {
                    "aws:SourceIp": "" 

More info can be found here:
If the plugin requesting a file is not accessed via that IP address, an access denied error will show up. You can also set a range of IP addresses.
With HLS and MPEG-DASH, you can restrict playback to your own domains.